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PPP & IP Analysis in the ISDN B-channel 


ISDN access to the Internet Service Provider 


The main problems encountered by users of the Internet connecting via ISDN lines are associated with setting 
up of the link and authentication at the Point-to-Point Protocol (PPP) level or with the IP routing. ISP 
connections can take place over the ISDN bearer channels (B-channel). With the AuroraDuet or AuroraTempo it 
is possible to capture this B-channel traffic and export it to AuroraExpert for analysis. 
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PPP Protocols At Work. 


The Point-to-Point Protocol is used in many systems from ISDN based dial-up Internet Service Provision to 
ADSL access. The PPP is a suit of simple protocols that provide a protocol carrying pipe between the user PC 
and the ISP gateway. PPP is therefore a transport protocol for the Internet Protocol and higher application 
layers. 


In it's most simple form a PPP session will consist of: 


¢ A link management protocol called Link Control Protocol (LCP) 
¢ An Authentication protocol for user security such as Password Authentication Protocol (PAP) or CHAP 
¢ Amanagement protocol for the Internet Protocol called Internet Protocol Control Protocol (IPCP) 


In typical systems within a WAN, other PPP protocols come into play such as: 


¢ Compression Control Protocol (CCP) controlling the types of compression used on the frames and 
headers 

¢ Bandwidth Control Allocation Protocol (BCAP) for managing the bandwidth used on the link (i.e. multiple 
B-channels for example) 

¢ Internet Protocol Control Protocol (IPCP) providing management and control of compression / encryption 
of Internet Protocol through the PPP pipe. 


The procedure for setting up a PPP link and establishing a connection to the Internet via an Internet Service 
Provider is illustrated in the message sequence below:- 
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PC (DTE) 


Event 2. 17:22:00.780 


ISP (SERVER) 


Operation Flow 


Set-up link using LCP 


Link Control Protocol 

Event 3 17:22:00.797 

Link Control Protocol 
Event 4 17:22:00.799 

Link Control Protocol 
Event5 17:22:00.816 

Link Control Protocol 

Event6 17:22:00.824 

Link Control Protocol 

Event 7 17:22:00.867 

Notify far end that CHAP authentication 
will take place 


Link Control Protocol 


Event 8 17:22:00.870 

Link Control Protocol 

Event9 17:22:00.887 

Link Control Protocol 

Event 10 17:22:00.916 

Challenge Handshake Authentication Protocol Challenge 
Event 11 17:22:00.938 

Challenge Handshake Authentication Protocol 
Event 12 17:22:00.957 


Response 
Challenge Handshake Authentication Protocol Success 
Event 13 17:22:00.959 

Internet Protocol Control Protocol Obtain IP address from server 
Event 14 17:22:00.979 

Internet Protocol Control Protocol 
Event 15 17:22:00.982 

IPCP set up Van Jacobson 
compression 


Compression Control Protocol 
Event 16 17:22:00.984 

Internet Protocol Control Protocol 
Event 17 17:22:00.994 


Internet Protocol Control Protocol Configuration Request 
Event 18 17:22:00.998 

Link Control Protocol 

Event 19 17:22:02.959 

Internet Protocol Control Protocol IP application data frames - IP layer 
Event 20 17:22:02.982 now up 
Internet Protocol Control Pro 
Event 21 17:22:03.989 
Internet Protocol Control Pro 
Event 22 17:22:04.004 
Internet Protocol Control Protocol 
Event 23 17:22:04.031 
Internet Protocol Control Pro 
Event 24 17:22:04.047 
Internet Protocol Control Protocol 
Event 25 17:22:04.087 
Internet Protocol Control Pro 


Event 26 17:22:04.103 


Internet Protocol Control Protocol 
Event 27 17:22:04.128 

Internet Protocol 

Event 28 17:22:04.202 

Internet Protocol 

Event 29 17:22:04.211 

Internet Protocol 
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The trace segment shown to the right shows the Event 12 17:22:00.957 24 Jan 2001 
detail level and information provided within the Address = 255 
AuroraExpert trace. PASS / FAIL events such as Control = 3 
PASSWORD acceptance are identified as a success | PPP Protocol (hex)=C223 
or failure for clear and easy diagnosis. Challenge Handshake Authentication Protocol 
SUCCESS 
PPP common failure modes can be broken down Identifier = 191 
into three categories:- Length = 4 
FF03C223 
1. Link problems 03BF0004 
This can entail: Event 13 17:22:00.959 24 Jan 2001 
- Physical connection not providing a path to the Address = 255 
server device Control = 3 
- The server LCP configuration being faulty. PPP Protocol (hex) = 8021 
- The encapsulation method differing between the Internet Protocol Control Protocol 
client and the server CONFIGURE REQUEST 
Identifier = 6 
2. Account Problems Length = 10 
IP-Address 
This is generally either caused by the account being | Option length = 6 


disabled or non-existent from the server perspective | !P-Address 195.30.0.94 
or an error in the password / username. It is possible | FF038021 

that the server refuses to allocate an IP address to 
the client PC (see routing problems below), 


3. Routing Problems 


This is usually caused by an incorrect server IP address configuration at the client PC end of the link. It may 
also manifest itself as a refusal by the server to allocate an IP address to the client (using IPCP configuration 
request with IP address set to 0.0.0.0). In most cases the client PC settings are at fault. Assuming a valid 
Internet account. 


AuroraExpert provides a comprehensive easy to use protocol decode and analysis package for diagnosis of 
these problems. To assist users of AuroraExpert with analysing PPP and other protocol problems, a flexible 
filtering application is included. Pre-defined complex filters for a number of related protocols are available to 
users of AuroraExpert from the Trend WEBsite or through Trend Customer Support Helpdesk, preventing the 
need for in-depth knowledge of filter techniques. These filter files can be logically combined to fine-tune the 
focus directly onto the problem. 


Other optional protocols supported by AuroraExpert include:- 


ISDN: DASS2 (UK), VN (France), 1TR6 (Germany), TPH1856 / THP1962 (Australia), Nortel (USA), N.I. 
(USA), AT&T (4ESS/5ESS — USA), DSS1 (ETSI / Q.931), CorNet N/T (Siemens), CorNet TS (Siemens), 
TN1R6 N/T, Q.SIG, X.25 (X.31), X.25 (LAPB) 


Access Network: V5.1 & V5.2 
Frame Relay: ITU-T Q.933 Annex A, ANSI 71.617 Annex D, “Gang of Four” LMI (Original LMI, FRF LMI). 


PPP /IP: LCP, CCP, PAP,CHAP, BAP, BACP, IPCP, OSINLCP, ATCP plus decoding of all RFC1700 PPP 
headers. IP. 
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